tm: always use UAC buffer for To-URI when building relayed CANCEL

Regardless of the setting of the FL_USE_UAC_TO msg flag, there doesn't
seem to be any reason to use the UAS To-URI if the UAC buffer contains a
different one; this is suggested by the comment, "/* build the CANCEL
from the INVITE which was sent out/*" indicating the UAC buffer version
of the INVITE, not the INVITE that was originally received.